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AMENDMENTS TO THE CLAIMS 

1 . (Currently amended): A method for filtering incoming data from an external 
computer network, comprising: 

a firewall that is coupled to said external computer network; 
a server computer system, coupled to an interna] computer network; 
a plurality of clients that are coupled to said server computer system, said 
plurality of clients being unable to access said external computer network directly; 
receiving, at said firewall, a document from said external computer network: 
determining, bv said firewall whether said document is from a known blocked 

site; 

in response to determining that said document is from a known blocked site, 
blocking, bv said firewall, said document without scanning said document; 

determining, bv said firewall, whether said document is from a known safe site; 

in response to determining that said document is from a known safe site, 
forwarding, bv said firewall, said document to said server without scanning said 
document, all of said plurality of clients being permitted to access said forwarded 
document: 

in response to determining that said document is not from a known blocked site or 
a known safe site, scannin g* bv said firewall, text fields included in said document &e 
^ ntent^ - moomittg - 4afo for pre-selected keywoid(s); 

blocking, bv said firewall, the document if anv of said text fields include fee 
incoming data if th e content that contains pre-selected keywords; [[and ]] 

said server computer system being prohibited from receiving said document in 
resp_o_ns_e_to said document being blocked; and 

indicating fliat_a_site that sent said document is a known blocked site by adding* 
by said firewall, the address of a block e d said site to a filtering table. 

2. (Canceled) 
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3. (Currently amended): The method according to claim 1 > wherein the document 
incoming data is allowed to pass per standard service rules if the content does not contain 
pre-selected keyword(s). 

4. (Currently amended): The method according to claim 1, further comprising 
storing an indication in said [[a]] filtering table of each known safe site 'Icnown cafe" 
sites that can be passed per standard service rules without having to be scanned for pre- 
selected keywords. 

5. (Currently amended): The method according to claim 1 9 wherein the step of 
indicating that a site that sent said document is a known blocked site bv adding, by said 
firewall, the address of a site to a filtering table further comprises adding tho address of a 
block e d sit e to a fi lt ering tablo, includes adding the address of the site to a 4 "known- 
block" table when said site has sent_a document that includes said pre-selected keywords 
so that the site will be blocked in the future without having its contents scanned for pre- 
selected keywords. 

6. (Original): The method according to claim 1, wherein the addition of a site to the 
filtering table is implemented using a strong text parsing language. 

7. (Original): The method according to claim 1, wherein the instance of the filter is 
periodically refreshed through a timed job on a Windows NT platform, a cron job on a 
UNIX platform, to enact the updated filtering tables. 

8. (Currently amended): A computer program product in a computer readable 
medium for use in a data processing system for filtering incoming data from an external 
computer network, the computer program product comprising: 

a firewall that is coupled to said external computer network: 
a server c omputer system coupled to an internal computer network; 
a plurality of clients that are coupled to said server computer system, said 
plurality of clients being unable to access said external computer network directly, 
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instructions for receiving, at said firewall, a document from said external 
computer network; 

instructions for determining, by said firewall, whether said document is from a 
known blocked site: 

in response to determining that said do cument i s from a known blocked site, 
instructions for blocking said document without scanning said document; 

instructions for determining, by said firewall whether said document is from a 
known safe site: 

in response to detenniningjhat said document is from a known safe site, 
instructions for forwarding said document to said server without scanning said document, 
allof said plurality of clients being permitted to access said forwarded document: 

in response to determining that said document is not from a known blocked site or 
a known safe site, instructions for scannin g, by said firewall, text fields included in said 
document the oo ft tont of incoming data for pre-selected kcyword(s); 

instructions for blockin g, by said firewall, the dnmme tit if any of said text fields 
include the incoming data if tho content that contains pre-sclected keywords; [[and]] 

said server computer system being prohibited from receiving said document in 
response to said_document being blocked: and 

instructions for indicating that a site that sent said document is a known blocked 
site bv inotruotiona for addin g, by said firewall, the address of said a block e d site to a 
filtering table. 

9. (Canceled) 

1 0. (Currently amended): The computer program product according to claim 8, 
further comprising instructions for allowing the document incoming data to pass per 
Standard service rules if the content does not contain pre-selected keyword(s). 

1 1 . (Currently amended): The computer program product according to claim 8, 
further comprising instructions for storins an indication in said creating -^ filtering table 
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of each known safe site "known 3afe" gitcs that can be passed per standard service rules 
without having to be scanned for pre-selected keywords. 

12. (Currently amended): The computer program product according to claim 8, 
wherein the instructions for indicating that a site that sent said document is a known 
blocked site by adding, bv said firew all, that address of said site to a .-filtering table further 
comprises adding the address of said Q r block e d site to a filtering tabl e , include s 
i asSruGtions for adding tho site to a "known-block" table when said site has sent a 
document that includes said pre-selected keywords so that the site will be blocked in the 
future without having its contents scanned for pre-selected keywords. 

13. (Original): The computer program product according to claim 8, wherein the 
instructions for addition of a site to the filtering table are implemented in a strong text 
parsing language. 

14. (Original): The computer program product according to claim 8, wherein the 
instance of the filter is periodically refreshed through a timed job on a Windows NT 
platform, a croti job on a UNIX platform, to enact the updated filtering tables, 

15. (Currently amended): A system for filtering incoming data from an external 
computer network, the system comprising: 

a_firewall that is coupled to said external computer network; 
a_s_erver computer syste m coupled to an internal computer network: 
a plurality of clients t hat are coupled to said server computer system, sai^ 
plu rality of clients being unable to access said external computer network directly: 
said firewall for receiving a document from said external computer network: 
S aid firewall for determining whether said document is from a known blocked 

site; 

in response to determining t hat said document is from a known blocked site, said 
firewall for blocking said document without scanning said document: 

said firewall for determinin g whether said document is from a known safe site: 
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in response to determining that said document is from a known safe site, said 
firewall for forwarding said document to said server without scanning said document, all 
of said plurality of clients being permitted to access said forwarded document: 

in response to determining that said document is not from a known blocked site or 
a known safe site, said firewall for means fog scanning text fields included in said 
document tho contont of Incoming data for pre-selected keyword (s); 

said firewall for m eans fo g blocking the document if any of said text fields include 
incoming data if tho content that contains pre-selected keywords; [[and]] 

said server computer system being prohibited from receiving said document in 
response to said document being blocked: and 

said firewall for indicating that a site that sent said document is a known blocked 
sitebY_ m e an$ for adding the address of a block e d said site to a filtering table. 
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